@openclaw/voice-call 2026.2.2

Direct Vulnerabilities

Known vulnerabilities in the @openclaw/voice-call package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `voice-call realtime WebSocket path` when oversized WebSocket frames are accepted without proper validation. An attacker can cause service unavailability by sending oversized frames remotely. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `@openclaw/voice-call` to version 2026.5.1-beta.1 or higher.	<2026.5.1-beta.1
L Replay Attack @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Replay Attack in the `callback` process. An attacker can alter the origin of a Plivo callback before it is rejected by replaying a captured valid callback for a live call. How to fix Replay Attack? Upgrade `@openclaw/voice-call` to version 2026.5.2 or higher.	<2026.5.2
M Replay Attack @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Replay Attack via the webhook signature verification process. An attacker can bypass replay detection by submitting requests with equivalent Base64 and Base64URL-encoded signatures, causing the system to treat them as distinct and allowing replayed requests to be accepted. How to fix Replay Attack? Upgrade `@openclaw/voice-call` to version 2026.5.2 or higher.	<2026.5.2
M Allocation of Resources Without Limits or Throttling @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `voice-call` process. An attacker can cause excessive resource consumption by sending oversized WebSocket frames before validation occurs. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `@openclaw/voice-call` to version 2026.5.2 or higher.	<2026.5.2
H Replay Attack @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Replay Attack in the `webhook-security.ts` process. An attacker can bypass replay protection by capturing a valid signed webhook and resending it with reordered query parameters, thereby triggering duplicate processing of voice-call events. How to fix Replay Attack? Upgrade `@openclaw/voice-call` to version 2026.5.2 or higher.	<2026.5.2
H Replay Attack @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Replay Attack due to improper derivation of the replay key in the `webhook-security.ts` process. An attacker can bypass replay protection and submit multiple authenticated requests by modifying the query string of the verification URL without altering the signature. How to fix Replay Attack? Upgrade `@openclaw/voice-call` to version 2026.5.2 or higher.	<2026.5.2
M Incorrect Authorization @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Incorrect Authorization via the webhook event deduplication. An attacker can trigger duplicate or stale call-state transitions by replaying Twilio webhook events with randomized event IDs. How to fix Incorrect Authorization? Upgrade `@openclaw/voice-call` to version 2026.2.23 or higher.	<2026.2.23
M Incorrect Authorization @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Incorrect Authorization in the group authorization process when `groupPolicy=allowlist` and `dmPolicy=pairing` are configured and pairing-store entries are present. An attacker can gain unauthorized group access by leveraging DM-paired identities to bypass group allowlist checks. This is only exploitable if both `groupPolicy=allowlist` and `dmPolicy=pairing` are enabled and pairing-store entries exist. How to fix Incorrect Authorization? Upgrade `@openclaw/voice-call` to version 2026.3.1 or higher.	<2026.3.1
H Allocation of Resources Without Limits or Throttling @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the media-stream WebSocket upgrades. An attacker can exhaust server resources by establishing multiple unauthenticated pre-start socket connections and keeping them open without validation. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `@openclaw/voice-call` to version 2026.2.22 or higher.	<2026.2.22
H Improper Authentication @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Improper Authentication in `resolveProvider()` for Ngrok webhooks. An attacker can cause unauthorized webhook requests to be accepted by supplying malicious headers, including `Forwarded` or `X-Forwarded-*`, which are not overwritten by the proxy. How to fix Improper Authentication? Upgrade `@openclaw/voice-call` to version 2026.2.3 or higher.	<2026.2.3
M Missing Authentication for Critical Function @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the `tunnel.allowNgrokFreeTierLoopbackBypass` configuration option in the webhook authentication. An attacker can trigger unauthorized webhook event handling and cause request flooding by sending forged requests to the publicly reachable webhook endpoint without a valid signature. Note: This is only exploitable if the `tunnel.allowNgrokFreeTierLoopbackBypass` option is explicitly enabled. How to fix Missing Authentication for Critical Function? Upgrade `@openclaw/voice-call` to version 2026.2.14 or higher.	<2026.2.14
H Missing Authentication for Critical Function @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the `verifyWebhook` function. An attacker can send forged webhook requests to the Telnyx voice-call endpoint by omitting signature verification, resulting in unauthorized actions being processed. How to fix Missing Authentication for Critical Function? Upgrade `@openclaw/voice-call` to version 2026.2.14 or higher.	<2026.2.14
C Authentication Bypass Using an Alternate Path or Channel @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacker can impersonate authorized users and execute privileged commands by sending forged HTTP POST requests with spoofed fields in the update payload. Note: This is only exploitable if the Telegram webhook is enabled and no webhook secret is configured. How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade `@openclaw/voice-call` to version 2026.2.13 or higher.	<2026.2.13

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

@openclaw/voice-call is an OpenClaw voice-call plugin

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the voice-call realtime WebSocket path when oversized WebSocket frames are accepted without proper validation. An attacker can cause service unavailability by sending oversized frames remotely.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade @openclaw/voice-call to version 2026.5.1-beta.1 or higher.

<2026.5.1-beta.1

Replay Attack

@openclaw/voice-call is an OpenClaw voice-call plugin

Affected versions of this package are vulnerable to Replay Attack in the callback process. An attacker can alter the origin of a Plivo callback before it is rejected by replaying a captured valid callback for a live call.

How to fix Replay Attack?